summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorJens Axboe <axboe@suse.de>2006-08-18 21:42:43 +0200
committerAdrian Bunk <bunk@stusta.de>2006-08-18 21:42:43 +0200
commitc1df7b7181ae16b4ec44a0b1e1bdf67f5a06f17e (patch)
treef39aa905ad7cb26fffadb6127be6b9817ccf36fd /drivers
parent3cfd644882784276280c07ad4b9eb086fa44222f (diff)
downloadlwn-c1df7b7181ae16b4ec44a0b1e1bdf67f5a06f17e.tar.gz
lwn-c1df7b7181ae16b4ec44a0b1e1bdf67f5a06f17e.zip
cdrom: fix bad cgc.buflen assignment (CVE-2006-2935)
The code really means to mask off the high bits, not assign 0xff. Reported by Marcus Meissner <meissner@suse.de>. Signed-off-by: Jens Axboe <axboe@suse.de> Signed-off-by: Adrian Bunk <bunk@stusta.de>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/cdrom/cdrom.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 879bbc26ce96..e866df084a56 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -1837,7 +1837,7 @@ static int dvd_read_bca(struct cdrom_device_info *cdi, dvd_struct *s)
init_cdrom_command(&cgc, buf, sizeof(buf), CGC_DATA_READ);
cgc.cmd[0] = GPCMD_READ_DVD_STRUCTURE;
cgc.cmd[7] = s->type;
- cgc.cmd[9] = cgc.buflen = 0xff;
+ cgc.cmd[9] = cgc.buflen & 0xff;
if ((ret = cdo->generic_packet(cdi, &cgc)))
return ret;